Short answer
In the first hour after a hack, contain the problem, call your bank if money moved and notify your cyber insurer before hiring anyone. Disconnect affected devices from the network, but do not wipe or power them off. Write down what happened and when. Many policies require you to use approved vendors or get consent before incurring costs, so a quick call to the insurer can protect coverage. This guide is general information and not legal advice, and policy terms vary.
What to do in the first 15 minutes
Start by stopping the spread without destroying evidence.
- Disconnect affected devices. Unplug the network cable or turn off Wi-Fi. Do not power the device off or wipe it, since that can erase information investigators need.
- Stop using the compromised account. Do not email staff or clients from it. The attacker may be watching.
- Call your bank if money moved. Ask the fraud line whether the transfer can be recalled or frozen. Speed matters.
- Tell one person in charge. Decide who is making decisions so staff are not acting on their own.
What to do if money was sent
Call the bank’s fraud line first, then file a complaint at the FBI’s Internet Crime Complaint Center. Reporting quickly gives the best chance of recovery, although results are never guaranteed. Keep the emails, invoices and payment records.
What to do if a password was entered on a fake page
Reset the password and sign the account out of all sessions, since a changed password alone may not end an attacker’s access. Then check the account for new inbox rules or forwarding settings, which attackers use to hide replies. Trustifi explains how this attack works. Your IT provider can help with these steps.
What to do if ransomware locks your files
Disconnect the affected devices and leave them powered on if possible. Do not wipe them. Do not contact the attackers or negotiate on your own. Whether a policy pays any ransom depends on its wording and applicable law, including sanctions rules, so involve your insurer first.
Call your insurer before hiring your own help
This is the step firms most often skip. Many policies require the firm to use approved vendors, such as forensic and legal providers, or to get consent before costs are incurred. Hiring your own IT firm or lawyer first can leave those costs unreimbursed.
Look for the claim hotline on your policy or ask your broker. The phishing and IT security checklist covers the same steps in a shorter form, including what to do if money was sent, if a password was entered and when to call your cyber insurer.
Write down what happened
Record the time you noticed the problem, what you saw, who was affected and every action taken. Keep screenshots, emails and logs. A clear timeline helps investigators and supports a claim. Many policies also require prompt notice, so a delay can create problems. The glossary entries on notice of circumstance and late notice explain why timing matters.
Who tells clients, and when
Hold off on notifying clients or employees until you have spoken with your insurer. If a policy includes breach response, a legal advisor often guides notification. Notification laws vary by state and by the type of data involved, so this is a question for qualified counsel.
What not to do
- Do not wipe or reinstall devices.
- Do not email everyone from the compromised account.
- Do not pay a ransom or negotiate without your insurer.
- Do not hire an IT firm or lawyer before calling the insurer.
- Do not delay reporting while you try to fix it quietly.
Real-world example
Consider a hypothetical nine-person architecture firm. The office manager realizes she entered her email password on a fake sign-in page. She tells the principal right away. They sign her out of all sessions, reset the password and check for inbox rules. The principal calls the claim hotline on the cyber policy and gets directed to an approved forensic provider.
Meanwhile the firm does not email clients from the account. Instead, it calls the clients whose invoices were in her inbox and warns them to confirm any bank changes by phone. The firm writes down the timeline as it goes.
What to check before an incident happens
Firms may want to review:
- Where the claim hotline and policy number are stored, outside the firm’s own network.
- Whether the policy uses approved vendors, and whether consent is required before costs.
- Whether the policy pays costs directly or reimburses the firm later. The comparing cyber quotes page explains this and the breach response lines.
- Who makes decisions and who calls the bank, the insurer and the IT provider.
- Whether the plan is printed, since email may be down.
Hardcover insight
Most firms have no plan, so the first hour is improvised. The costly mistakes tend to be small ones, such as hiring help before calling the insurer or wiping a laptop. A one-page plan with phone numbers, written before an incident, removes most of that guesswork. Free guidance is also available from NIST’s small business cybersecurity resources and CISA.
Related questions
What should I do first after a hack?
Contain it by disconnecting affected devices without wiping them. Call your bank if money moved, then notify your insurer.
Should I call my insurer before my IT provider?
Often yes. Many policies require approved vendors or consent before costs are incurred, so calling the insurer first can protect coverage.
Should I turn off a computer that has been hacked?
Disconnect it from the network instead, and avoid wiping it. Powering off can erase information investigators may need.
Should I pay a ransom?
Do not pay or negotiate without your insurer. Coverage depends on policy wording and applicable law, including sanctions rules.
When do I have to notify clients about a breach?
It depends on state law and the type of data involved. Ask your insurer and qualified counsel before notifying.